JP5279379B2 - Authentication system and authentication method - Google Patents

Abstract

In order to prevent leakage of an authentication symbol string such as a credit card number, and enable a user to be authenticated: an ID issuance server 20 receives the first eight digits of the credit card number from a portable telephone device 10 of the user and issues a one-time ID to the portable telephone device 10; and a service provision server 30 receives the last eight digits of the credit card number and the one-time ID from a PC 11, and transmits the one-time ID and those last eight digits to a number construction and authentication processing server 40 that receives the one-time ID and the last eight digits from the service provision server 30, communicates with the ID issuance server 20 and acquires the first eight digits which correspond to the one-time ID, reconstructs the credit card number, and performs authentication.

Description

  The present invention provides an authentication system and an authentication method for authenticating that a user is a legitimate person using an authentication symbol string such as a credit card number, for example, when performing credit card payment or logging on to a server. About.

  Conventionally, when making a credit card payment at an Internet shop on the Internet, the user needs to input his / her credit card number and information such as the card expiration date and card name used for authentication into a personal computer (PC). was there.

  For this reason, information such as the user's credit card number, card expiry date, card name, etc. will be transmitted to the Internet shop server via the Internet, and this information will be leaked from the Internet and the Internet shop server. there were.

  On the other hand, for example, a technique is known in which a part of a credit card number and attribute information such as a user's name and date of birth are input and authentication is performed based on them (see Patent Document 1). ).

  Also, by dividing the information into first data and second data, storing the first data in the client system, and storing the second data in the remote server, so that all information is not stored in any device The technique which performs is known (refer patent document 2).

  In addition, a technique for preventing leakage of information on a communication path by dividing electronic information as a product and transmitting it through different paths at different times is disclosed (see Patent Document 3).

  Further, the credit card information is divided into two, one of the pieces of division information is stored in the user terminal, the other is stored in the custody center information device, and the settlement center is stored in the user terminal at the time of settlement A technique is known in which a credit card is restored by using the division information stored in the custody center information device and merged to be used for credit and settlement processing (see Patent Document 4).

JP 2005-521181 A JP 2005-522775 A JP 2003-13229 A JP 2007-41957 A

  For example, according to the technique of Patent Document 1, the entire credit card number does not leak, but authentication is not sufficient because it is not authentication using the entire credit card number. Also, if the user's PC is infected with a virus, the information entered by the key may be transmitted to the outside by the virus and leaked. In this case, one of the entered credit card numbers may be leaked. If information used for authentication and other authentication is leaked, there is a problem that authentication is made illegal using the information. Further, according to the technique of Patent Document 2, all information does not leak from each device, but when a malicious third party uses the client system, authentication is performed in the same manner as a legitimate user. There is a problem.

  Further, according to the technique of Patent Document 3, although leakage in the communication path can be prevented, since the electronic information itself exists in the transmission-side device, it cannot be prevented from leaking from the transmission-side device. According to the technique of Patent Document 4, the entire credit card information does not leak from each of the user terminal and the deposit center information device, but it is necessary to store the credit card division information in the deposit center information device. Yes, the user cannot rest assured that the deposit center is not a trusted organization. Further, when a malicious third party uses a user terminal, there is a problem that authentication is performed in the same manner as a legitimate user.

  The present invention has been made in view of the above problems, and an object of the present invention is to appropriately prevent, for example, the leakage of an authentication symbol string such as a credit card number and appropriately authenticate that the user is a valid person. It is to provide technology that can.

  To achieve the above object, an authentication system according to an aspect of the present invention includes an authentication server that performs authentication using an authentication symbol string, and the authentication system includes a one-time ID issuing server, a service server, and the like. And an authentication symbol string construction server, wherein the one-time ID issuing server includes a first receiving means for receiving a first symbol string that is a part of the authentication symbol string from the first terminal of the user; An ID issuing means for issuing a time ID; a first symbol string; and a one-time ID storage means for storing the issued one-time ID in association with each other. The second receiving means for receiving the second symbol string other than the first symbol string of the authentication symbol string and the one-time ID, and the first description corresponding to the one-time ID by communicating with the one-time ID issuing server. 1st symbol sequence acquisition means for acquiring a sequence, 1st symbol sequence acquired, 2nd symbol sequence received from the second terminal, 2 Authentication symbol string transmission means for transmitting the message to the authentication server.

  Here, the one-time ID is an ID that can be used temporarily or / and only once. Also, the authentication symbol string is a symbol string that is used for authentication, which is a combination of numbers, letters, symbols, or two or more of these, such as a credit card number, bank or securities. Numbers used for services on networks of financial institutions such as companies (for example, account numbers, member numbers, etc.), login passwords for network services, user numbers issued by public institutions, telephone numbers, addresses, names, secret words, etc. Or it refers to a combination of these. In addition, accepting a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from the second terminal is accepted directly from the second terminal or indirectly through another device or device group. Including acceptance.

  According to such an authentication system, the first symbol string and the second symbol string of the authentication symbol string are input from different terminals, and the entire authentication symbol string does not leak from each terminal. In addition, the first symbol string is transmitted to the ID issuing server, but the second symbol string is not transmitted, so that the entire authentication symbol string is not leaked. Also, an authentication symbol string can be constructed based on the one-time ID from the first symbol string and the second symbol string input from different terminals and appropriately used for authentication.

  In the above authentication system, the one-time ID issuing server further includes first authentication key storage means for storing the user's first authentication key and the user's management ID, and the first receiving means is the user's first terminal. The one-time ID issuing server obtains the first authentication key and the first symbol string from the first authentication key by collating the received first authentication key with the first authentication key stored in the authentication key storage means. First authentication key authenticating means for performing authentication in the first stage is further provided, and the ID issuing means issues a one-time ID when the authentication is successful, and the one-time ID storage means includes the one-time ID, 1 symbol string and the management ID of the user who has succeeded in authentication are stored in association with each other, and the second receiving means of the authentication symbol string construction server receives the second authentication key of the user from the second terminal, the second symbol string, Receive a one-time ID Then, the authentication symbol string construction server stores the second authentication key storage means for storing the second authentication key of the user and the management ID of the user, and stores the management ID corresponding to the received second authentication key in the second authentication key. A management ID acquisition unit that acquires the first symbol string, and the first symbol string acquisition unit may acquire the first symbol string based on the acquired management ID and the received one-time ID.

  According to such an authentication system, the first stage authentication is performed in the one-time ID issuing server, and the authentication symbol string construction server obtains the first symbol string using the second authentication key, Since it functions as the second stage authentication, the accuracy of user authentication can be improved.

  Further, the authentication system includes a service server, and the authentication server has a return means for performing a predetermined confirmation process including authentication based on the authentication symbol string received from the authentication symbol string construction server and returning the confirmation result. The service server may further include a service providing unit that receives the confirmation result and starts providing the service when the confirmation result indicates permission to execute the predetermined service. According to such an authentication system, provision of a service can be started according to a predetermined confirmation result including authentication.

  In the authentication system, the first terminal may be a telephone, and the first authentication key may be a telephone number of the telephone that is notified when a call is made from the telephone. According to such an authentication system, the user does not need to input the first authentication key, and the first terminal for which the authentication is successful is limited to a specific telephone, so that the accuracy of authentication can be improved.

  The authentication system includes a service server, the service server receiving first telephone number receiving means for receiving a telephone number of a user's telephone, and telephone number transmitting means for transmitting the received telephone number to a one-time ID issuing server. The one-time ID issuing server includes a second telephone number receiving unit that receives a telephone number from the service server, and a telephone number registration unit that registers the received telephone number in the first authentication key storage unit. Also good. According to such an authentication system, data registered in the service server can be diverted, so that no additional load is imposed on the user in order to register the telephone number of the user's telephone in the one-time ID issuing server. . Therefore, the user can easily use the authentication system.

  In the authentication system, the ID issuing means may notify the one-time ID by voice. According to such an authentication system, any telephone that can use voice communication can be used for authentication by the authentication system.

  In the above authentication system, the first symbol string acquisition means of the authentication symbol string construction server is an issued one-time ID that sequentially receives the one-time ID issued by the one-time ID issuing server and the corresponding first symbol string. A receiving means, an issued one-time ID storage means for storing the received one-time ID and the first symbol string, and a first one corresponding to the one-time ID received from the service server from the issued one-time ID storage means. You may make it have the 1st symbol string search means which searches a symbol string. According to such an authentication system, when the one-time ID is received from the service server, the first symbol string can be searched for in the authentication symbol string construction server, so that the processing response can be promptly performed.

  In the above authentication system, the first symbol string acquisition means of the authentication symbol string construction server includes a one-time ID transmitting means for transmitting the received one-time ID to the one-time ID issuing server, and a one-time ID issuing server from the one-time ID issuing server. A corresponding first symbol string receiving means for receiving the first symbol string corresponding to the ID, and the one-time ID issuing server stores the issued one-time ID and the corresponding first symbol string One-time ID storage means, one-time ID reception means for receiving the one-time ID transmitted from the authentication symbol string construction server, and one-time received from the authentication symbol string construction server based on the issued one-time ID storage means First symbol string search means for searching for the first symbol string corresponding to the ID, and first symbol string for transmitting the searched first symbol string to the authentication symbol string construction server It may have a signal means.

  According to the authentication system, since it is not necessary for the authentication symbol string construction server to store all the one-time IDs and the first symbol strings issued by the ID issuing server, the amount of memory area required in the authentication symbol string construction server Can be reduced.

  An authentication method according to an aspect of the present invention is an authentication method in an authentication system including an authentication server that performs authentication using an authentication symbol string, and the authentication system includes a one-time ID issuing server, an authentication symbol string, A first receiving step in which the one-time ID issuing server receives a first symbol string that is a part of the authentication symbol string from the first terminal of the user; A one-time ID issuing step for issuing a one-time ID to one terminal, and a one-time ID issuing server that associates the first symbol string with the issued one-time ID and stores them in the one-time ID storage means An ID storing step; and a second reception step in which the authentication symbol string construction server receives a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from the second terminal. A first symbol string obtaining step in which the authentication symbol string construction server obtains a first symbol string corresponding to the received one-time ID, a first symbol string obtained by the authentication symbol string construction server, and reception An authentication symbol string construction step for constructing an authentication symbol string based on the second symbol string, an authentication symbol string transmission step in which the authentication symbol string construction server transmits the constructed authentication symbol string to the authentication server, and an authentication server An authentication step for executing a confirmation process including authentication based on the symbol string, and a confirmation result transmission step for the authentication server to transmit the result of the confirmation process.

  According to such an authentication method, the first symbol string and the second symbol string of the authentication symbol string are input from different terminals, and the entire authentication symbol string does not leak from each terminal. In addition, the first symbol string is transmitted to the ID issuing server, but the second symbol string is not transmitted, so that the entire authentication symbol string is not leaked. Also, an authentication symbol string can be constructed based on the one-time ID from the first symbol string and the second symbol string input from different terminals and appropriately used for authentication.

  In the above authentication method, the one-time ID issuing server has first authentication key storage means for storing the first authentication key of the user and the management ID of the user, and the authentication symbol string construction server has the second authentication of the user. A second authentication key storage means for storing the key and the management ID of the user. In the first receiving step, the first authentication key and the first symbol string are obtained from the first terminal of the user, In the ID issuing step, the first authentication is performed by comparing the received first authentication key with the first authentication key stored in the authentication key storage means. In the one-time ID storage step, the one-time ID, the first symbol string, and the management ID of the user who has been successfully authenticated are stored in association with each other, and in the second reception step, the second terminal 2 certification key In the second symbol string transmission step, the second authentication key and the second authentication symbol string are transmitted to the authentication symbol string construction server, and the authentication symbol string construction server And a management ID acquisition step of acquiring a management ID corresponding to the second authentication key received in the third reception step from the second authentication key storage means. In the first symbol string acquisition step, the acquired management ID and the reception The first symbol string may be acquired based on the one-time ID.

  According to such an authentication method, the first stage authentication is performed in the one-time ID issuing server, and the authentication symbol string construction server acquires the first symbol string by using the second authentication key, Since it functions as the second-stage authentication, the accuracy of user authentication can be improved.

  According to the authentication method, the first terminal is a telephone, the first authentication key is a telephone number of the telephone, and the service server receives a telephone number of the user's telephone, a first telephone number receiving step; A telephone number transmitting step of transmitting the received telephone number to the one-time ID issuing server; a second telephone number receiving step in which the one-time ID issuing server receives the telephone number from the service server; and a first authentication of the received telephone number You may make it further have the telephone number registration step made to register in a key memory | storage means.

  According to such an authentication method, data registered in the service server can be diverted, so that no additional load is imposed on the user in order to register the telephone number of the user's telephone in the one-time ID issuing server. . Therefore, the user can easily use the authentication system.

  Embodiments of the present invention will be described with reference to the drawings. The embodiments described below do not limit the invention according to the claims, and all the elements and combinations described in the embodiments are essential for the solution of the invention. Is not limited.

  First, an authentication system according to the first embodiment of the present invention will be described.

  FIG. 1 is a diagram for explaining an outline of the configuration and processing of an authentication system according to the first embodiment of the present invention.

  The authentication system 1 is a system that performs authentication using a credit card number (an example of an authentication symbol string), and includes a mobile phone 10 (an example of a first terminal) and a PC (Personal Computer) 11 (an example of a second terminal). And an ID issuing server 20 (an example of a one-time ID issuing server), a service server 30, and a number construction / authentication processing server 40 (an example of an authentication symbol string construction server and an authentication server). The cellular phone 10, the PC 11, the ID issuing server 20, the service server 30, and the number construction / authentication processing server 40 include a CPU (Central Processing Unit), a ROM (Read Only Memory), a RAM (Random Access Memory), and the like (not shown). Each function described later of these devices can be realized by the CPU executing a program stored in a ROM or the like.

  For example, the mobile phone 10 and the PC 11 are owned by the user. The mobile phone 10 can perform voice communication with other telephones (or a server having a telephone function), send / receive data to / from a Web server, and send / receive e-mails via a network. You can also.

  The PC 11 stores a Web browser and e-mail software, and can send and receive data to and from various servers via a network, and can send and receive e-mail via the Internet.

  The ID issuing server 20 is managed by, for example, an ID issuing organization authorized by a credit card company. The ID issuing server 20 has a one-time ID management DB 21 and performs processing for issuing a one-time ID to the mobile phone 10.

  In the present embodiment, the one-time ID management DB 21 associates the number (first symbol string) of the part A (for example, the first 8 digits) of the credit card number with the one-time ID issued for the number. Remember. Here, the one-time ID is an ID that can be used temporarily or / and only once. The one-time ID is unique among the one-time IDs that are valid at the time of issue.

  The service server 30 provides a service in the network. In the present embodiment, the service server 30 is managed by, for example, a company that operates a net shop. The service server 30 has a purchase management DB 31 and provides a service for selling products. The purchase management DB 31 stores the name of the product purchased by the user, the price, the destination of the product (for example, the user's address), and the like. Note that the service provided by the service server 30 is not limited to this. For example, a net banking service in a financial institution may be provided, or a net service for residents by a public institution may be provided. Any service using a network may be used.

  The number construction / authentication processing server 40 is managed by, for example, a credit card company that issues credit cards. The number construction / authentication processing server 40 has an issued one-time ID management DB 41 and a card member management DB 42, and performs a process for constructing a credit card number, a settlement confirmation process including authentication based on the credit card number, and the like. Run.

  The issued one-time ID management DB 41 stores the issued one-time ID and the number of the portion A of the corresponding credit card number. Here, the issue time of the one-time ID may be stored in association with the one-time ID, and the one-time ID that has passed a predetermined time from the issue time and the corresponding partial A number may be deleted. Further, the once-used one-time ID and the corresponding partial A number may be deleted. The card member management DB 42 manages credit card numbers and other data (for example, card expiration date, card name, etc.) used for payment confirmation processing including authentication.

  Next, an outline of processing of the authentication system 1 will be described.

  Here, it is assumed that the user has a credit card issued by a credit card company.

  First, when a user wants to purchase a product through an online shop, the user inputs the number (first symbol string) of the part A of the credit card number to the mobile phone 10 and the mobile phone 10 The part A number is transmitted (FIG. 1 (1)). Here, since the mobile phone 10 inputs only a part A number, that is, a part of the credit card number, the entire credit card number is not leaked from the mobile phone 10.

  Upon receiving the partial A number from the mobile phone 10, the ID issuing server 20 determines (issues) a one-time ID that is unique at that time, and determines the determined one-time for the mobile phone 10 that has transmitted the partial A number. The ID is transmitted (FIG. 1 (2)), the partial A number and the one-time ID are associated with each other and stored in the one-time ID management DB 21, and the partial A number and the one-time ID are stored in the number construction / authentication processing server 40. Transmit (FIG. 1 (3)). As a result, the user's mobile phone 10 receives and outputs (for example, displays) the one-time ID. In addition, since the ID issuing server 20 stores only a partial A number, that is, a part of the credit card number, even if information is leaked from the ID issuing server 20, the entire credit card number is not leaked. Absent.

  The number construction / authentication processing server 40 stores the partial A number and the one-time ID received from the ID issuing server 20 in the issued one-time ID management DB 41.

  The user accesses the Web site of the net shop, that is, the service server 30, using the PC 11, determines a product to be purchased, and selects payment by credit card. Thereafter, the PC 11 obtains the one-time ID acquired by the mobile phone 10, the part B (for example, the last 8 digits) number (second symbol string) of the credit card number, and other data necessary for purchase (for example, Card name, card expiration date, user name, product destination, etc .: purchase user data) are transmitted to the service server 30 (FIG. 1 (4)).

  When the service server 30 receives a one-time ID, a credit card number part B (e.g., the last 8 digits) (second symbol string), and purchase user data from the PC 11, the user name and delivery The data necessary for selling the product such as the delivery destination and the purchased product is registered in the purchase management DB 31. In addition, the service server 30 numbers the one-time ID, the partial B number, and data (for example, the card name, the card expiration date, etc .: other data for payment) necessary for the payment confirmation process (authentication, etc.) of the credit card. It is transmitted to the construction / authentication processing server 40 (FIG. 1 (5)).

  When the number construction / authentication processing server 40 receives the one-time ID, the partial B number, and other data for settlement, the number construction / authentication processing server 40 obtains the partial A number associated with the received one-time ID from the issued one-time ID management DB 41. The entire credit card number is constructed based on the acquired and received partial B number and the acquired partial A number. Next, the number construction / authentication processing server 40 refers to the card member management DB 42 and confirms settlement based on the credit card number and other data for settlement whether or not to permit the purchase of the product. In the payment confirmation, whether or not the user is a valid user is authenticated, and if the authentication is successful, that is, if the user is a valid user, whether the purchase is within an allowable range is further confirmed. In authenticating whether the user is a valid user, if the card member management DB 42 has data that matches (matches) the credit card number, the card holder, and the expiration date, the authentication is successful and there is no matching data. Authentication fails. Whether or not the purchase is within the allowable range is determined depending on whether or not the amount of the product to be purchased falls within the range of the allowable amount allowed by the user in advance.

  Next, the number construction / authentication processing server 40 transmits the settlement confirmation result to the service server 30 (FIG. 1 (6)).

  If the settlement confirmation result from the number construction / authentication processing server 40 is successful, the service server 30 executes processing for starting shipping of the product designated for purchase, assuming that the user's order is valid. On the other hand, when the settlement confirmation result is unsuccessful, it is determined that the user's order is invalid, and execution of processing for canceling the user's order is started. The service server 30 transmits the validity / invalidity result of the order to the PC 11 (FIG. 1 (7)).

  Next, processing in the authentication system will be described in detail using the flowcharts shown in FIGS.

  FIG. 2 is a flowchart of processing of the mobile phone according to the first embodiment of the present invention.

  When the user issues an instruction to access the ID issuing server 20, the mobile phone 10 accesses the ID issuing server 20 and requests a web page from the ID issuing server 20 (step S1). Next, the mobile phone 10 receives the one-time ID issuance page transmitted from the ID issuance server 20, and displays the one-time ID issuance page on the screen (step S2).

  The mobile phone 10 determines whether or not the input of the partial A number to the one-time ID issuance page has been completed (step S3), and if not completed (step S3: NO), the mobile phone 10 waits until the end. When the process is completed (step S3: YES), the input partial A number is transmitted to the ID issuing server 20 (step S4, FIG. 1 (1)). Thereafter, the mobile phone 10 receives the page including the one-time ID transmitted from the ID issuing server 20 and displays it on the screen (step S5).

  As described above, in the authentication system 1 according to the present embodiment, the mobile phone 10 only inputs and transmits only the partial A number with respect to the credit card number. The whole will not leak.

  FIG. 3 is a flowchart of the process of the ID issuing server according to the first embodiment of the present invention.

  The ID issuing server 20 determines whether or not there is a page request from any of the user's mobile phones 10 (step S11). If there is no page request, nothing is done while there is a page request. In this case (step S11: YES), a one-time ID issuance page is transmitted to the requesting mobile phone 10 (step S12, FIG. 1 (2)).

  Next, the ID issuing server 20 determines whether or not the partial A number has been received from the mobile phone 10 (step S13). If the partial A number has not been received, the ID issuing server 20 waits until the partial A number is received. In (Step S13: YES), a one-time ID associated with the partial A number is issued (Step S14), and the one-time ID and the partial A number are registered in the one-time ID management DB 21 (Step S15). A page including the ID is transmitted to the mobile phone 10 (step S16), and the one-time ID and the partial A number registered in the one-time ID management DB 21 are transmitted to the number construction / authentication processing server 40 (step S17, FIG. 3)).

  FIG. 4 is a flowchart of the processing of the PC according to the first embodiment of the present invention.

  When the PC 11 accepts an access request from the user to the website of the net shop, that is, the service server 30, the PC 11 requests a page from the service server 30 (step S21), receives the web page of the net shop from the service server 30, It is displayed on the screen (step S22).

  Next, the PC 11 determines whether or not the purchase of the product has been determined by the user (step S23). If the purchase of the product has not been determined (step S23: NO), the PC 11 waits until it is determined, while the purchase of the product is If it is determined (step S23: YES), a request for a purchase page is transmitted to the service server 30 (step S24).

  Next, the PC 11 receives the purchase page from the service server 30 and displays it on the screen (step S25). In the purchase page, the PC 11 receives input of various data necessary for purchase from the user (step S26). In the present embodiment, the PC 11 uses the one-time ID acquired by the user from the mobile phone 10, the partial B number (second symbol string) of the user's credit card number, and other data necessary for purchase (for example, Card name, card expiration date, user name, merchandise destination, etc.).

  Thereafter, the PC 11 determines whether or not the input of data necessary for purchase has been completed (step S27). If the input has not been completed (step S27: NO), the PC 11 waits until the input is completed and the input has been completed. If it is (step S27: YES), the input data is transmitted to the service server 30 (step S28).

  Thus, in the authentication system 1 according to the present embodiment, the PC 11 only inputs and transmits the partial B number with respect to the credit card number, and therefore the entire credit card number leaks from the PC 11. There is nothing to do. Moreover, even if the one-time ID and the partial B number are leaked, the one-time ID is a temporary or one-time ID, so that it is appropriately prevented that the product is purchased by using these IDs. be able to.

  FIG. 5 is a flowchart of the process of the service server according to the first embodiment of the present invention.

  The service server 30 determines whether or not there is a page request from the PC 11 (step S31). If there is no page request (step S31: NO), the service server 30 waits until there is a page request, while there is a page request. In (step S31: YES), the network shop page is transmitted to the requesting PC 11 (step S32).

  Next, the service server 30 determines whether or not there is a purchase page request from the PC 11 (step S33). If there is no purchase page request (step S33: NO), the service server 30 waits until there is a purchase page request. If there is a purchase page request (step S33: YES), the purchase page is transmitted to the requesting PC 11 (step S34).

  Thereafter, the service server 30 determines whether or not purchase data has been received (step S35). If purchase data has not been received (step S35: NO), the service server 30 waits until receiving the purchase data while receiving purchase data. If so (step S35: YES), necessary data from the purchase data, for example, the user name, the delivery destination of the product, etc. are registered in the purchase management DB 31 (step S36).

  Next, the service server 30 transmits the payment data (for example, the one-time ID, the partial B number of the credit card number, the card name, the card expiration date, the product amount, etc.) to the number construction / authentication processing server 40 (step S37). FIG. 1 (5)).

  Thereafter, the service server 30 determines whether or not the settlement confirmation result has been received from the number construction / authentication processing server 40 (step S38). If the settlement confirmation result has not been received (step S38: NO), While waiting until the payment confirmation result is received, when the payment confirmation result is received (step S38: YES), it is determined whether or not the payment confirmation result is successful (step S39).

  Next, if the payment confirmation result is successful, the service server 30 indicates that the purchase can be made with the corresponding credit card, and therefore processing when the order is valid (processing when the order is valid: for example, Then, a process of transmitting data necessary for a process of sending the ordered product to the user to a predetermined terminal, a process of transmitting an order result indicating that the order is successful, and the like are started (step S40). On the other hand, if the payment confirmation result is unsuccessful, this means that authentication by credit card number has failed, or authentication has succeeded, but the limit has been exceeded, so processing when canceling an order ( Processing when order is invalid: For example, processing for deleting the data of the product for which the order has been received, processing for transmitting the order result that the order has failed, etc. are started (step S41)

  As described above, in the authentication system 1 according to the present embodiment, the service server 30 receives only the partial B number with respect to the credit card number, so that the entire credit card number is not leaked from the service server 30. . Moreover, even if the one-time ID and the part B number are leaked, the one-time ID is a temporary or one-time ID, so that it is possible to appropriately prevent the purchase of goods or the like using these IDs. .

  FIG. 6 is a flowchart of the processing of the number construction / authentication processing server according to the first embodiment of the present invention.

  The number construction / authentication processing server 40 determines whether or not a one-time ID, a partial B number, other data for settlement, etc. have been received from the service server 30 (step S51). If not received (step S51: NO) ), While waiting for reception, if received (step S51: YES), a partial A number is acquired based on the one-time ID (step S52). In this embodiment, the number construction / authentication processing server 40 searches the issued one-time ID management DB 41 for a partial A number associated with the same one-time ID as the one-time ID received from the service server 30. It is acquired by. The number construction / authentication processing server 40 sequentially receives the partial A number and the corresponding issued one-time ID from the ID issuing server 20, and issues the received partial A number and the one-time ID to the issued one-time ID. Processing to be stored in the time ID management DB 43 is executed.

  Next, the number construction / authentication processing server 40 constructs a credit card number based on the acquired partial A number and the partial B number received from the service server 30 (step S53). In the present embodiment, the number construction / authentication processing server 40 constructs a credit card number by connecting the partial A number and the partial B number.

  Thereafter, the number construction / authentication processing server 40 refers to the card member management DB 42 and executes a credit settlement confirmation process (step S54). Specifically, the number construction / authentication processing server 40 determines whether the constructed credit card number, the card name transmitted from the service server 30, and the card expiration date match the data in the card member management DB 42. Authenticate. Further, when the number construction / authentication processing server 40 succeeds in the user authentication (when it matches the data in the card member DB 42), the product amount in the payment data is stored in the card member management DB 42. Judge whether it falls within the allowable amount. As a result, the user authentication is successful and the payment confirmation is successful when the amount of the purchased product falls within the allowable amount, and the payment confirmation fails otherwise.

  The number construction / authentication processing server 40 determines whether or not the settlement confirmation is successful (step S55). If the settlement confirmation is successful (step S55: YES), the number construction / authentication processing server 40 is successful. A settlement confirmation result indicating that the transaction has been confirmed is transmitted to the service server 30 (step S56). On the other hand, if the settlement confirmation has failed, a settlement confirmation result indicating that the transaction has failed is transmitted to the service server 30 (step S57).

  Thus, in the authentication system 1 according to the present embodiment, the number construction / authentication processing server 40 appropriately constructs a credit card number from the divided partial A number and partial B number, Authentication using numbers can be performed appropriately.

  Next, an authentication system according to the second embodiment of the present invention will be described. In addition, the same code | symbol shall be attached | subjected about the part similar to 1st Embodiment.

  FIG. 7 is a diagram for explaining the outline of the configuration and processing of the authentication system according to the second embodiment of the present invention.

  The ID issuing server 20 of the authentication system 1 according to the present embodiment has a one-time ID management DB 22 instead of the one-time ID management DB 21 of the first embodiment.

  The one-time ID management DB 22 includes a first user ID (for example, a terminal ID of the mobile phone 10 or a user identification (PIN) code: a first authentication key) for authenticating a user, a partial A number of a credit card number, The one-time ID issued for the number and the user management ID are stored in association with each other. Here, the user management ID is managed to be the same for the same user in the one-time ID management DB 22 and the second user ID management DB 44 described later. As a method for managing the same user with the same user management ID, for example, the user can apply for the use of the authentication system 1 by sending a document describing various information to a credit card company by mail. When the credit card company applies, the user management ID is registered in the number construction / authentication server 40, the user management ID is notified to the ID issuing organization side, and the ID issuing server 20 is registered. There is a way to make it. Note that the partial A number and the one-time ID in the one-time ID management DB 22 are not stored when there is no one-time ID issuance request from the mobile phone 10.

  The number construction / authentication processing server 40 according to the present embodiment has an issued one-time ID management DB 43 instead of the issued one-time ID management DB 41 of the first embodiment, and the second user ID management DB 44 In addition.

  The issued one-time ID management DB 43 stores the issued one-time ID, the portion A number of the corresponding credit card number, and the user management ID. Here, the issuance time of the one-time ID is stored in association with the one-time ID, and the one-time ID that has passed a predetermined time from the issuance time, and the corresponding partial A number and user management ID are deleted. Alternatively, the once-used one-time ID and the corresponding partial A number and user management ID may be deleted.

  The second user ID management DB 44 stores a second user ID (second authentication key) for authenticating the user and the user management ID of the user in association with each other. Here, the second user ID is notified in advance to the user in writing when an application for using the authentication system 1 is made.

  Next, an outline of processing of the authentication system 1 according to the second embodiment will be described.

  Here, it is assumed that the user has a credit card issued by a credit card company. In addition, an application for using the authentication system 1 is made, and the one-time ID management DB 22 of the ID issuing server 20 stores the user management ID assigned to the user and the PIN of the user's mobile phone 10 as the first user ID. It is assumed that a code (first user ID) is registered. The second user ID management DB 44 of the number construction / authentication processing server 40 has the same user management ID as the user management ID registered in the one-time ID management DB 22 and the second user ID notified to the user. Is registered.

  First, when a user wants to purchase a product through an online shop, the user inputs a credit card number part A (for example, the first 8 digits) into the mobile phone 10 and the mobile phone 10 enters the ID issuing server 20. In contrast, a partial A number is transmitted. Here, the PIN code is automatically transmitted from the mobile phone 10, and the partial A number and the PIN code are transmitted to the ID issuing server 20 (FIG. 7 ( 1)). Here, since the mobile phone 10 inputs only a partial A number regarding the credit card number, the entire credit card number is not leaked from the mobile phone 10.

  When the ID issuing server 20 receives the partial A number and the PIN code from the mobile phone 10, the ID issuing server 20 performs first-stage personal authentication by comparing the received PIN code with the PIN code of the one-time ID management DB 22. If the personal authentication is successful, that is, if the same PIN code exists, a one-time ID that is unique at that time is determined (issued), and the determined one-time ID is assigned to the mobile phone 10. It transmits (FIG. 7 (2)). If personal authentication fails, an error is returned to the mobile phone 10 and a one-time ID is not issued. The ID issuing server 20 stores the issued one-time ID and the partial A number in the one-time ID management DB 22 in association with the PIN code and the user management ID. The ID issuing server 20 transmits the partial A number, the issued one-time ID, and the user management ID of the corresponding user to the number construction / authentication processing server 40 (FIG. 7 (3)).

  As a result, the user's mobile phone 10 receives and outputs (for example, displays) the one-time ID. In addition, since the ID issuing server 20 stores only a partial A number, that is, a part of the credit card number, even if information is leaked from the ID issuing server 20, the entire credit card number is not leaked. Absent. In addition, since the ID issuing server 20 performs personal authentication using the PIN code stored in the mobile phone 10, it is possible to appropriately prevent a one-time ID from being issued when an unregistered PIN code is transmitted. Can do.

  The number construction / authentication processing server 40 stores the partial A number received from the ID issuing server 20, the one-time ID, and the user management ID in the issued one-time ID management DB 43.

  The user accesses the Web site of the net shop, that is, the service server 30, using the PC 11, determines a product to be purchased, and selects payment by credit card. Thereafter, the user uses the PC 11 to obtain the second user ID, the one-time ID acquired by the mobile phone 10, the part B (for example, the last 8 digits) number of the credit card number, and other data necessary for purchase. (For example, card name, card expiration date, user name, product delivery address, etc .: user data for purchase) is transmitted to the service server 30 (FIG. 7 (4)).

  When the service server 30 receives the second user ID, the one-time ID, the portion B number of the credit card number, and the purchase user data from the PC 11, the user name, the destination of the shipment, the purchased product, etc. Data necessary for selling the product is registered in the purchase management DB 31. Next, the service server 30 receives the second user ID, the one-time ID, the partial B number, and the data necessary for the payment confirmation process (authentication, etc.) of the credit card (for example, the card name, the card expiration date, the amount of the product) Etc .: other data for settlement) is transmitted to the number construction / authentication processing server 40 (FIG. 7 (5)).

  When the number construction / authentication processing server 40 receives the second user ID, the one-time ID, the partial B number, and other data for settlement from the service server 30, the number construction / authentication processing server 40 uses the second user ID and the one-time ID. The second stage personal authentication is performed. That is, the number construction / authentication processing server 40 acquires the user management ID corresponding to the received second user ID from the second user ID management DB 44 and associates it with the user management ID acquired from the issued one-time ID management DB 43. The obtained one-time ID is acquired, and authentication is performed by comparing the acquired one-time ID with the one-time ID received from the service server 30.

  In this second stage personal authentication, if the acquired one-time ID matches the one-time ID received from the service server 30, the authentication is successful, and the user management ID corresponding to the received second user ID is the second. When it cannot be acquired from the user ID management DB 44, when the one-time ID associated with the acquired user management ID cannot be acquired from the issued one-time ID management DB 43, or when the acquired one-time ID and the one received from the service server 30 If the time ID does not match, personal authentication fails.

  If the second-stage authentication is successful, the number construction / authentication processing server 40 acquires the received part A number from the issued one-time ID management DB 43 and receives the part A number associated with the matched one-time ID. The entire credit card number is constructed based on the B number and the acquired partial A number, and the card member management DB 42 is referred to based on the credit card number and other data for settlement, and the purchase of the product is permitted. Confirm the settlement.

  Then, the number construction / authentication processing server 40 transmits the settlement confirmation result (including the authentication result when the second-stage authentication fails) to the service server 30 (FIG. 7 (6)).

  If the settlement confirmation result from the number construction / authentication processing server 40 is successful, the service server 30 executes processing for starting shipping of the product designated for purchase, assuming that the user's order is valid. On the other hand, when the settlement confirmation result is unsuccessful, it is determined that the user's order is invalid, and execution of processing for canceling the user's order is started. The service server 30 transmits the validity / invalidity result of the order to the PC 11 (FIG. 7 (7)).

  Next, processing in the authentication system according to the second embodiment will be described in detail.

  FIG. 8 is a flowchart of the process of the ID issuing server according to the second embodiment of the present invention. In addition, about the process similar to ID issuing server which concerns on 1st Embodiment shown in FIG. 3, the same code | symbol is attached | subjected and description is abbreviate | omitted.

  In step S61, the ID issuing server 20 determines whether or not the partial A number and PIN code are received from the mobile phone 10, and if the partial A number and PIN code are not received (step S61: NO). On the other hand, if it is received (step S61: YES), the first-stage personal authentication is performed by comparing the received PIN code with the PIN code of the one-time ID management DB 22.

  The ID issuing server 20 determines whether the personal authentication is successful, that is, determines whether the PIN code (first user ID) is registered (step S62).

  As a result, when the personal authentication is successful (step S62: YES), the process proceeds to step S14. On the other hand, if the authentication has failed (step S62: NO), an error process for notifying the mobile phone 10 that the authentication has failed is executed (step S65).

  After performing step S14, the ID issuing server 20 stores the issued one-time ID and partial A number in the one-time ID management DB 22 in association with the PIN code and user management ID (step S63). move on.

  After performing step S16, the ID issuing server 20 transmits the partial A number, the issued one-time ID, and the user management ID of the corresponding user to the number construction / authentication processing server 40 (step S64, FIG. 7 (3)).

  FIG. 9 is a flowchart of the processing of the number construction / authentication processing server according to the second embodiment of the present invention. In addition, about the process similar to the number construction | authentication processing server which concerns on 1st Embodiment shown in FIG. 6, the same code | symbol is attached | subjected and description is abbreviate | omitted.

  When the number construction / authentication processing server 40 receives the second user ID, one-time ID, partial B number, payment data, etc. from the service server 30 (step S51: YES), the received second user ID is It is determined whether or not it is registered in the second user ID management DB 44 (step S71). If it is not registered (step S71: NO), registration using authentication using a one-time ID is performed. Since it means that the user is not a user, that is, the personal authentication in the second stage is unsuccessful, the process proceeds to step S75.

  On the other hand, if registered (step S71: YES), the number construction / authentication processing server 40 acquires the user management ID corresponding to the received second user ID from the second user ID management DB 44 (step S72). The one-time ID associated with the acquired user management ID is acquired from the issued one-time ID management DB 43 (step S73), and the acquired one-time ID matches the one-time ID received from the service server 30. Is determined (step S74). As a result, when both one-time IDs match (step S74: YES), it means that the user has issued the one-time ID by the ID issuing server 20, and therefore the number construction / authentication processing server No. 40 proceeds to the next step 52 as authentication success. On the other hand, if both the one-time IDs do not match (step S74: NO), it cannot be authenticated that the user has issued the one-time ID by the ID issuing server 20, so the number construction / authentication processing server 40 Assuming that the personal authentication in the second stage has failed, the process proceeds to step S75.

  In step S75, the number construction / authentication processing server 40 transmits to the service server 30 that the second-stage authentication has failed or that the payment confirmation processing has failed (FIG. 7 (6)).

  According to the authentication system 1 according to the second embodiment, it is possible to appropriately prevent the one-time ID from being issued from other than the mobile phone 10 that can transmit the registered PIN code, and the mischievous act by the unregistered user Can be prevented appropriately.

  Further, if the one-time ID and the second user ID are not prepared, the personal authentication in the second stage in the number construction / authentication processing server 40 will not succeed. Even if the ID has been issued, unauthorized use by a third party can be prevented appropriately. In addition, a credit card number can be appropriately constructed and used for authentication using a one-time ID that is used to achieve such advantages.

  Next, an authentication system according to a third embodiment of the present invention will be described. In addition, the same code | symbol shall be attached | subjected about the part similar to 1st Embodiment and 2nd Embodiment.

  FIG. 10 is a diagram for explaining the outline of the configuration and processing of the authentication system according to the third embodiment of the present invention.

  The ID issuing server 20 of the authentication system 1 according to the third embodiment has a one-time ID management DB 23 instead of the one-time ID management DB 22 of the second embodiment. The ID issuing server 20 further includes a shop ID management DB 24.

  The one-time ID management DB 23 stores a first user ID (for example, the telephone number of the mobile phone 10) for authenticating the user, a partial A number of the credit card number, and the issued one-time ID in association with each other. . Note that the partial A number and the one-time ID in the one-time ID management DB 23 are not stored when there is no one-time ID issuance request from the mobile phone 10.

  The shop ID management DB 24 stores an ID (shop ID) of a shop that can be settled by issuing a one-time ID.

  The number construction / authentication processing server 40 according to the present embodiment has an issued one-time ID management DB 45 instead of the issued one-time ID management DB 43 of the second embodiment.

  The issued one-time ID management DB 45 stores the issued one-time ID, the partial A number of the corresponding credit card number, and the telephone number of the mobile phone 10 that issued the one-time ID. Here, the issuance time of the one-time ID is stored in association with the one-time ID, and the one-time ID, the corresponding partial A number, and the corresponding telephone number that have passed a predetermined time from the issuance time are deleted. Alternatively, the once-used one-time ID, the corresponding partial A number, and the corresponding telephone number may be deleted.

  The service server 30 according to the present embodiment has a user management DB 32 instead of the user management DB 31 of the second embodiment.

  The user management DB 32 stores a user's net shop ID, the user's address, a telephone number, and the like. The address and telephone number of the user management DB 32 are registered by, for example, transmitting to the service server 30 when the user starts using the service of the service server 30. The user's net shop ID is notified in advance to the user registered in the service of the service server 30.

  Next, an outline of processing of the authentication system 1 according to the third embodiment will be described.

  Here, it is assumed that the user has registered with the service server 30 to receive the use of the service. In the user management DB 32, the user's address and the telephone number of the user's mobile phone 10 are registered. It shall be. In addition, it is assumed that the user is notified of the net shop ID.

  First, in response to a user instruction, the PC 11 displays a product purchase page from the service server 30, accepts a product designation, accepts a credit card payment, and accepts an input for an online shop ID.

  The PC 11 transmits the net shop ID, the product designation, and the settlement designation to the service server 30 (FIG. 10 (1)).

  The service server 30 performs user authentication using the transmitted net shop ID. If the authentication is successful, the user's telephone number stored in the user management DB 32 and a shop given in advance by the credit card company The ID is transmitted to the ID issuing server 20 (FIG. 10 (2)).

  The ID issuing server 20 determines whether or not the shop ID received from the service server 30 is stored in the shop ID management DB 24. If the shop ID is stored, the received ID is stored in the one-time ID management table 23. sign up. This eliminates the need for the user himself / herself to register the telephone number of his / her mobile phone 10 in the ID issuing server 20.

  Here, in the authentication system 1, in order for the service server 30 to make a credit card payment, the user needs to make a call to a predetermined telephone number to which the ID issuing server 20 can respond using the mobile phone 10.

  When the user's mobile phone 10 receives an incoming call to a predetermined telephone number that the ID issuing server 20 can respond to, the ID issuing server 20 starts a call with the mobile phone 10 and the telephone number of the mobile phone 10 Get (caller ID). The ID issuing server 20 determines whether or not the acquired telephone number is stored in the one-time ID management DB 23, and if so, instructs the mobile phone 10 to key in the partial A number. The voice is transmitted, and the partial A number is recognized by the voice by the key input of the cellular phone 10 by the user (FIG. 10 (3)).

  The ID issuing server 20 determines (issues) a unique one-time ID at that time, and transmits the determined one-time ID to the mobile phone 10 by voice ((4) in FIG. 10). Thereby, in the user's mobile phone 10, the one-time ID is output as a voice, and the user can grasp the one-time ID as a voice.

  The ID issuing server 20 stores the issued one-time ID (data) and the partial A number in the one-time ID management DB 23 in association with the corresponding telephone number. Next, the ID issuing server 20 transmits the partial A number, the issued one-time ID, and the corresponding telephone number to the number construction / authentication processing server 40 (FIG. 10 (5)). Here, since only a partial A number is stored for the credit card number in the ID issuing server 20, even if information is leaked from the ID issuing server 20, the entire credit card number is leaked. There is no.

  The number construction / authentication processing server 40 stores the partial A number, the one-time ID, and the telephone number received from the ID issuing server 20 in the issued one-time ID management DB 45.

  Thereafter, the PC 11 in accordance with a user instruction, the net shop ID, the one-time ID acquired by the mobile phone 10, the portion B number of the credit card number, and other data required for authentication (for example, the card name, Card expiration date) is transmitted to the service server 30 (FIG. 10 (6)).

  When the service server 30 receives the net shop ID, the one-time ID, the part B number of the credit card number, and the authentication data from the PC 11, it registers the data such as the purchased product in the user management DB 32, Number of one-time ID, partial B number, telephone number, and data required for payment confirmation processing (authentication, etc.) of credit card (for example, card name, card expiration date, product amount, etc .: other data for payment) The data is transmitted to the construction / authentication processing server 40 (FIG. 10 (7)).

  When the telephone number, the one-time ID, the partial B number, and other data for settlement are received from the service server 30, the number construction / authentication processing server 40 performs personal authentication using the telephone number and the one-time ID. . That is, the number construction / authentication processing server 40 performs authentication based on whether or not a telephone number corresponding to the received telephone number is stored in the issued one-time ID management DB 45. In addition, the number construction / authentication processing server 40 acquires the one-time ID corresponding to the telephone number from the issued one-time ID management DB 45 and collates the acquired one-time ID with the one-time ID received from the service server 30. Authenticate by

  In this personal authentication, if the acquired one-time ID matches the one-time ID received from the service server 30, the authentication is successful, and the telephone number corresponding to the received telephone number is stored in the issued one-time ID management DB 45. If not, or if the acquired one-time ID and the one-time ID received from the service server 30 do not match, the personal authentication fails.

  When the authentication is successful, the number construction / authentication processing server 40 acquires the partial A number associated with the matched one-time ID from the issued one-time ID management DB 45 and receives the received partial B number, Whether the entire credit card number is constructed based on the acquired partial A number, and whether or not the purchase of the product is permitted with reference to the card member management DB 42 based on the credit card number and other data for settlement Confirm settlement.

  Then, the number construction / authentication processing server 40 transmits the settlement confirmation result (including the authentication result when the authentication fails) to the service server 30 ((8) in FIG. 10).

  If the settlement confirmation result from the number construction / authentication processing server 40 is successful, the service server 30 executes processing for starting shipping of the product designated for purchase, assuming that the user's order is valid. On the other hand, when the settlement confirmation result is unsuccessful, it is determined that the user's order is invalid, and execution of processing for canceling the user's order is started.

  Next, the number construction / authentication processing server 40 according to a modification of the present invention will be described.

  FIG. 11 is a configuration diagram of the number construction / authentication processing server 40 according to a modification of the present invention. Note that the present modification can be applied to any of the first to third embodiments, but here, an example applied to the first embodiment is shown.

  In this modification, the function by the number construction / authentication processing server 40 in the first embodiment is realized by the number construction server 40a and one or more authentication processing servers 40b.

  The number construction server 40a is provided in, for example, a predetermined number construction company permitted by a credit card company, executes a process for constructing a credit card number in the number construction / authentication processing server 40, and constructs the credit number constructed. And processing for transmitting the data required for payment confirmation to the authentication processing server 40b (FIG. 11 (1)), receiving the payment confirmation result from the payment processing server 40b (FIG. 11 (2)), Processing to be transmitted to the server 30 is executed.

  The authentication processing server 40b is provided in each credit card company, for example, and executes a payment confirmation process including authentication of a credit card number, and is required for a credit card number and other payment confirmations from the request source. When the correct data is transmitted (FIG. 11 (1)), the settlement confirmation is performed based on the data, and the settlement confirmation result is returned to the request source (FIG. 11 (2)).

  According to this modification, an existing server that is executing the settlement confirmation process in the credit card company can be used as it is as the authentication processing server 40b.

  Next, an authentication system according to another modification of the present invention will be described.

  FIG. 12 is a partial configuration diagram of an authentication system according to another modification of the present invention. Note that the present modification can be applied to any of the first to third embodiments, but here, an example applied to the first embodiment is shown.

  As shown in FIG. 12A, the authentication system 1 includes a service and a number construction / authentication processing server 50 that combine the functions of the service server 30 and the number construction / authentication processing server 40 in the above embodiment. Also good. This configuration is suitable, for example, when one organization (network service provider) independently performs network service and authentication. For example, for network service of a financial institution, network service by a public institution, etc. Can be used.

  Further, as shown in FIG. 12B, data such as a one-time ID and a partial B number is transmitted from the PC 11 to the number construction / authentication processing server 40, and the number construction / authentication processing server 40 constructs the number and performs authentication. If the authentication result is successful, the service server 30 may start providing a service via the PC 11 (for example, the PC 11).

  Although the present invention has been described based on the embodiments, the present invention is not limited to the above-described embodiments, and can be applied to various other modes.

  For example, in the first embodiment, the issued one-time ID and the partial A number are transmitted in advance to the number construction / authentication processing server 40 and transmitted from the service server 30 by the number construction / authentication processing server 40. However, the present invention is not limited to this, and the issued one-time ID and the partial A number can be transmitted to the number construction / authentication processing server 40. The number issuing / authentication processing server 40 transmits the one-time ID received from the service server 30 to the ID issuing server 20, and the ID issuing server 20 corresponds to the one-time ID. The partial A number may be retrieved and transmitted to the number construction / authentication processing server 40.

  In the second embodiment, the issued one-time ID, partial A number, and user management ID are transmitted to the number construction / authentication processing server 40 in advance, and the number construction / authentication processing server 40 uses the service server. The user management ID is specified on the basis of the second user ID transmitted from 30, and the partial A number is searched and acquired by the user management ID and the one-time ID. However, the present invention is not limited to this. Instead, the issued one-time ID, the partial A number, and the user management ID are stored in the ID issuing server 20 without being transmitted to the number construction / authentication processing server 40, and the number construction / authentication processing server 40 is stored. Identifies the user management ID from the second user ID received from the service server 30 and transmits the identified user management ID to the ID issuing server 20. Acquires the one-time ID and the partial A number corresponding to the user management ID and transmits them to the number construction / authentication processing server 40, and the number construction / authentication processing server 40 searches for the partial A number corresponding to the one-time ID. In addition, the issued one-time ID, the partial A number, and the user management ID may be stored in the ID issuing server 20 without being transmitted to the number construction / authentication processing server 40. The number construction / authentication processing server 40 identifies the user management ID from the second user ID received from the service server 30 and transmits the identified user management ID and one-time ID to the ID issuing server 20. The issuing server 20 searches for and acquires the partial A number corresponding to the user management ID and the one-time ID, and transmits it to the number construction / authentication processing server 40. Ri, numbers construction and authentication processing server 40, may acquire a portion A number.

  Further, in the first to third embodiments, an example in which authentication is performed using a credit card number has been shown. However, the present invention is not limited to this, for example, a number for a network service of a financial institution (for example, Authentication using account numbers, member member IDs, etc., personal numbers issued by public institutions, login passwords in service providers, online shop member numbers, user addresses, names, phone numbers, email addresses, or combinations thereof In short, the present invention can be applied to any symbol string for authentication (authentication symbol string). Here, the authentication symbol string may be a number, a character, a symbol, or a symbol string combining any of a plurality of types.

In the above embodiment, the credit card number is divided into the first half part and the second half part, such as the first 8 digits and the last 8 digits, and is input at different terminals. However, the present invention is not limited to this, and for example, it may be divided into two parts, an odd-numbered character and an even-numbered character, and input to different terminals, respectively, or a predetermined number of credit card numbers (for example, (The last 8 digits) may be divided so that they belong to different parts. In short, what is divided into two according to a predetermined rule may be input to different terminals. As the credit card number, in addition to the ticket number, a credit card security code (for example, CVV2 (Card Verification Value), CVC2 (Card
Validation Code), CID (Card Identification Number), etc. may also be included.

  In the first to third embodiments, the user PC 11 has been described as an example of the second terminal. However, the present invention is not limited to this, and can transmit data to the service server 30, for example. An apparatus provided by a net shop management company or the like may be used.

  Moreover, although the example using the mobile phone 10 is shown in the third embodiment, the present invention is not limited to this, and a fixed phone may be used.

  In the first to third embodiments, the authentication symbol string is divided by a predetermined division method and transmitted by different terminals, and the number construction / authentication processing server 40 constructs the authentication symbol string. However, for example, the division method is determined by the designation of the user or the designation of the ID issuing server 20, and the authentication symbol string is divided and transmitted by different terminals according to the division method, so that the number construction / authentication processing server In 40, a notification of the determined division method may be received and an authentication symbol string may be constructed based on the division method. In addition, the mobile phone 10 determines a method for dividing the authentication information sequence according to a predetermined algorithm, and divides the authentication symbol sequence according to the division method and transmits the authentication symbol sequence to different terminals. It is also possible to notify the authentication processing server 40 and construct the authentication symbol string according to the division method notified by the number construction / authentication processing server 40.

It is a figure explaining the outline of a composition and processing of an authentication system concerning a 1st embodiment of the present invention. It is a flowchart of the process of the mobile telephone which concerns on 1st Embodiment of this invention. It is a flowchart of a process of the ID issuing server which concerns on 1st Embodiment of this invention. It is a flowchart of the process of PC concerning 1st Embodiment of this invention. It is a flowchart of the process of the service server which concerns on 1st Embodiment of this invention. It is a flowchart of a process of the number construction / authentication processing server according to the first embodiment of the present invention. It is a figure explaining the structure of the authentication system which concerns on 2nd Embodiment of this invention, and the outline of a process. It is a flowchart of a process of the ID issuing server which concerns on 2nd Embodiment of this invention. It is a flowchart of a process of the number construction | assembly / authentication process server which concerns on 2nd Embodiment of this invention. It is a figure explaining the structure of the authentication system which concerns on 3rd Embodiment of this invention, and the outline of a process. It is a block diagram of the number construction and authentication processing server which concerns on the modification of this invention. It is a one part block diagram of the authentication system which concerns on the other modification of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 Authentication system, 10 mobile phone, 11 PC, 20 ID issuing server, 21, 22, 23 One-time ID management DB, 30 Service server, 31 Purchase management DB, 32 User management DB, 40 Number construction and authentication processing server, 40a Number construction server, 40b authentication processing server, 41, 43, 45 Issued one-time ID management DB, 42 card member management DB, 44 second user ID management DB.

Claims (15)

A one-time ID issuing server;
An authentication symbol string construction server,
The one-time ID issuing server
First receiving means for receiving a first symbol string that is part of the authentication symbol string from the first terminal of the user;
ID issuing means for issuing a one-time ID to the first terminal;
One-time ID storage means for storing the first symbol string and the issued one-time ID in association with each other;
The authentication symbol string construction server
Second receiving means for receiving a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from a second terminal;
First symbol string acquisition means for acquiring the first symbol string corresponding to the one-time ID by communicating with the one-time ID issuing server;
Construction means for constructing the authentication symbol string based on the acquired first symbol string and the received second symbol string;
An authentication system comprising: an authentication symbol string transmission means for transmitting the constructed authentication symbol string to an authentication server that performs authentication using the authentication symbol string. The one-time ID issuing server
A first authentication key storage means for storing the first authentication key of the user and the management ID of the user;
The first receiving means obtains the first authentication key and the first symbol string from the first terminal of the user;
The one-time ID issuing server
Further comprising first authentication key authentication means for performing first-stage authentication by comparing the received first authentication key with the first authentication key stored in the first authentication key storage means;
The ID issuing means issues the one-time ID when the authentication is successful,
The one-time ID storage means stores the one-time ID, the first symbol string, and the management ID of a user who has been successfully authenticated in association with each other,
The second receiving means of the authentication symbol string construction server receives the second authentication key of the user, the second symbol string, and the one-time ID from the second terminal;
The authentication symbol string construction server
Second authentication key storage means for storing the second authentication key of the user and the management ID of the user;
A management ID acquisition means for acquiring a management ID corresponding to the received second authentication key from the second authentication key storage means;
The authentication system according to claim 1, wherein the first symbol string acquisition unit acquires the first symbol string based on the acquired management ID and the received one-time ID. A service server;
The authentication server is
Based on the authentication symbol string received from the authentication symbol string construction server, a predetermined confirmation process including authentication is performed, and return means for returning a confirmation result is provided.
The service server
The authentication system according to claim 1, further comprising a service providing unit that receives the confirmation result and starts providing the service when the confirmation result indicates permission to execute a predetermined service. The first terminal is a telephone;
The authentication system according to claim 2, wherein the first authentication key is a telephone number of the telephone that is notified when a call is made from the telephone. With a service server,
The service server
First telephone number receiving means for receiving the telephone number of the telephone of the user;
Telephone number transmitting means for transmitting the received telephone number to the one-time ID issuing server,
The one-time ID issuing server
Second telephone number receiving means for receiving the telephone number from the service server;
5. The authentication system according to claim 4, further comprising telephone number registration means for registering the received telephone number in the first authentication key storage means. The authentication system according to any one of claims 1 to 5, wherein the ID issuing means notifies the one-time ID by voice. The first symbol string acquisition means of the authentication symbol string construction server includes:
Issued one-time ID receiving means for sequentially receiving the one-time ID issued by the one-time ID issuing server and the corresponding first symbol string;
Issued one-time ID storage means for storing the received one-time ID and the first symbol string;
The first symbol string search means for searching the first symbol string corresponding to the one-time ID received from the second terminal from the issued one-time ID storage means. The authentication system according to one item. The first symbol string acquisition means of the authentication symbol string construction server includes:
One-time ID transmitting means for transmitting the received one-time ID to the one-time ID issuing server;
Corresponding first symbol string receiving means for receiving a first symbol string corresponding to the one-time ID from the one-time ID issuing server;
The one-time ID issuing server
Issued one-time ID storage means for storing the issued one-time ID and the corresponding first symbol string;
One-time ID receiving means for receiving the one-time ID transmitted from the authentication symbol string construction server;
First symbol string search means for searching for a first symbol string corresponding to the one-time ID received from the authentication symbol string construction server based on the issued one-time ID storage means;
7. The authentication system according to claim 1, further comprising: a first symbol string transmission unit configured to transmit the searched first symbol string to the authentication symbol string construction server. A first reception step in which the one-time ID issuing server receives a first symbol string that is a part of the authentication symbol string from the first terminal of the user;
A one-time ID issuing step in which the one-time ID issuing server issues a one-time ID to the first terminal;
A one-time ID storing step in which the one-time ID issuing server stores the first symbol string and the issued one-time ID in association with one-time ID storage means ;
Authentication symbol string construction server, a second reception step of receiving the second symbol string other than the first symbol string of the authentication symbol string, and the one-time ID from the second terminal,
A first symbol string acquisition step in which the authentication symbol string construction server acquires the first symbol string corresponding to the received one-time ID;
A construction step in which the authentication symbol string construction server constructs the authentication symbol string based on the acquired first symbol string and the second symbol string received from the second terminal;
An authentication symbol string transmission step in which the authentication symbol string construction server transmits the constructed authentication symbol string to an authentication server that performs authentication using the authentication symbol string;
An authentication step in which the authentication server executes a confirmation process including authentication based on the authentication symbol string;
An authentication method comprising: a confirmation result transmission step in which the authentication server transmits a result of the confirmation process. The one-time ID issuing server includes a first authentication key storage unit that stores a first authentication key of the user and a management ID of the user.
The authentication symbol string construction server has second authentication key storage means for storing a second authentication key of the user and a management ID of the user,
In the first receiving step, the first authentication key and the first symbol string are acquired from the first terminal of the user,
In the one-time ID issuance step, the first authentication is performed by comparing the received first authentication key with the first authentication key stored in the authentication key storage means, and the authentication is successful. The one-time ID is issued,
In the one-time ID storage step, the one-time ID, the first symbol string, and the management ID of the user who has been successfully authenticated are stored in association with each other,
In the second receiving step, a second authentication key and the second symbol string are received from the second terminal,
The authentication symbol string construction server further includes a management ID acquisition step of acquiring a management ID corresponding to the second authentication key received in the second reception step from the second authentication key storage unit,
The authentication method according to claim 9, wherein in the first symbol string acquisition step, a first symbol string is acquired based on the acquired management ID and the received one-time ID. The first terminal is a telephone, and the first authentication key is a telephone number of the telephone ;
Sa Bisusaba is a first telephone number receiving step of receiving said telephone number of the telephone of the user,
A telephone number transmitting step in which the service server transmits the received telephone number to the one-time ID issuing server;
A second telephone number receiving step in which the one-time ID issuing server receives the telephone number from the service server;
The authentication method according to claim 10, further comprising a telephone number registration step of registering the received telephone number in the first authentication key storage unit. Receiving means for receiving a first symbol string that is a part of the authentication symbol string from the first terminal of the user;
ID issuing means for issuing a one-time ID to the first terminal;
One-time ID storage means for storing the first symbol string and the issued one-time ID in association with each other;
Transmitting means for transmitting the first symbol string corresponding to the one-time ID to an authentication symbol string construction server that constructs the authentication symbol string;
The authentication symbol string construction server receives a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from the user's second terminal, and corresponds to the one-time ID by the transmitting means. receiving a first symbol string before symbol sent, the build authentication symbol string based on the received first symbol string and the second symbol string accepted, the authentication symbol string constructed, authentication symbol Sent to an authentication server that authenticates using a string,
One-time ID issuing server. A first symbol string that is a part of an authentication symbol string is received from the user's first terminal, a one-time ID is issued to the first terminal, and the first symbol string is associated with the issued one-time ID. An authentication symbol string construction server communicable with an authentication server that performs authentication using the one-time ID issuing server and the authentication symbol string,
Receiving means for receiving a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from a second terminal of the user;
Symbol string acquisition means for acquiring the first symbol string corresponding to the one-time ID by communicating with the one-time ID issuing server;
Construction means for constructing the authentication symbol string based on the acquired first symbol string and the second symbol string received from the second terminal;
An authentication symbol string construction server comprising authentication symbol string transmission means for transmitting the constructed authentication symbol string to the authentication server. Receiving a first symbol string that is part of the authentication symbol string from the first terminal of the user;
An ID issuing step of issuing a one-time ID to the first terminal;
A one-time ID storage step for storing the first symbol string and the issued one-time ID in association with each other;
Transmitting the first symbol string to an authentication symbol string construction server that constructs the authentication symbol string;
The authentication symbol string construction server receives a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from the second terminal of the user, and corresponds to the one-time ID by the transmission step. receiving a first symbol string before symbol sent, the build authentication symbol string based on the received first symbol string and the second symbol string accepted, the authentication symbol string constructed, authentication symbol Sent to an authentication server that authenticates using a string,
Symbol string transmission method. A first symbol string that is a part of an authentication symbol string is received from the user's first terminal, a one-time ID is issued to the first terminal, and the first symbol string is associated with the issued one-time ID. A one-time ID issuing server for storing
An authentication symbol string construction method executed by a server that can communicate with an authentication server that performs authentication using the authentication symbol string,
Receiving a second symbol string other than the first symbol string of the authentication symbol string and the one-time ID from a second terminal of the user;
A symbol string acquisition step of acquiring the first symbol string corresponding to the received one-time ID;
A construction step of constructing the authentication symbol string based on the acquired first symbol string and the second symbol string received from the second terminal;
An authentication symbol string construction method comprising: an authentication symbol string transmission step of transmitting the constructed authentication symbol string to the authentication server.

Images